feat: read-only API key scoping

New keys can be created as "Full access" (default, unchanged) or
"Read-only" — read-only keys can only make GET/HEAD/OPTIONS requests,
enforced once in requireSessionOrApiKey (lib/api-auth.ts) rather than in
every route, since a route has no way to know a request came from a
scoped key without that check. Existing keys default to full access —
no behavior change for anyone who doesn't opt in.

Also included in this migration: the chat_messages table for the
next commit (chat history persistence) — generated together since both
touched packages/db/src/schema/users.ts in the same pass.

Verified locally: created both a read-only and a full-access key,
confirmed GET succeeds and POST 403s on the read-only key, confirmed
POST still works on the full-access key, and checked the scope badges
render correctly in the real Settings → API Keys UI.

packages/db/src/schema/users.ts

@@ -12,6 +12,7 @@ import { relations } from "drizzle-orm";
 export const userRoleEnum = pgEnum("user_role", ["user", "moderator", "admin"]);
 export const tierEnum = pgEnum("tier", ["free", "pro"]);
 export const unitPrefEnum = pgEnum("unit_pref", ["metric", "imperial"]);
+export const apiKeyScopeEnum = pgEnum("api_key_scope", ["full", "read"]);
 
 export const users = pgTable("users", {
   id: text("id").primaryKey(),
@@ -96,6 +97,7 @@ export const apiKeys = pgTable("api_keys", {
   userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   name: text("name").notNull(),
   keyHash: text("key_hash").notNull().unique(),
+  scope: apiKeyScopeEnum("scope").notNull().default("full"),
   lastUsedAt: timestamp("last_used_at"),
   createdAt: timestamp("created_at").notNull().defaultNow(),
 });